mssql数据库被挂马

[jim8590251]

最近MSSQL数据库老被挂马,里面老有字段被加了<script..</script>
没办法,我只能用update一句一句的执行啊
可是遇到了ntext格式的字段,里面内容看不到,替换也不行了
我想在页面把上该字段的内容输出来,也是输出一半就没有了,现在不知道怎么办了
高手赐教

[zhnzzy]

up

[ReViSion]

一行一行更新还可以，批处理就不知道，怎么样处理啦

[dobear_0922]

DECLARE @fieldtype sysname
SET @fieldtype='varchar'

--删除处理
DECLARE hCForEach CURSOR GLOBAL
FOR
SELECT N'update '+QUOTENAME(o.name)
    +N' set  '+ QUOTENAME(c.name) + N' = replace(' + QUOTENAME(c.name) + ',''<script_src=http://ucmal.com/0.js> </script>'','''')'
FROM sysobjects o,syscolumns c,systypes t
WHERE o.id=c.id 
    AND OBJECTPROPERTY(o.id,N'IsUserTable')=1
    AND c.xusertype=t.xusertype
    AND t.name=@fieldtype
EXEC sp_MSforeach_Worker @command1=N'?'

[dobear_0922]

作好SQL Server安全管理：http://topic.csdn.net/u/20080418/16/aeb5d4d1-3fb9-4e1f-80b8-d7629afdd0f3.html（6楼和7楼）

[ChinaJiaBing]

举个例子,数据库源...

[ReViSion]

可以这样，给你个参考

if object_id('test') is not null
drop table test
go

create table test
(id int identity,txt ntext)


insert into test(txt)
select N'dddddd<script>ddddddddd</script>fffffffffffffff'
insert into test(txt)
select N'<script>ddddddddd</script>ffffbbfff'

----select s=charindex('<script>',txt),e=charindex('</script>',txt),txt from test
declare @s int,@e int,@id int
DECLARE @ptrval binary(16)

DECLARE cur CURSOR FOR
select s=charindex('<script>',txt),e=charindex('</script>',txt),id from test

OPEN cur

FETCH NEXT FROM cur
INTO @s, @e,@id

-- Check @@FETCH_STATUS to see if there are any more rows to fetch.
WHILE @@FETCH_STATUS = 0
BEGIN
if isnull(@e,0)>isnull(@s,0)
begin
set @e=@e-@s+9;
set @s=@s-1;


SELECT @ptrval = TEXTPTR(txt)
FROM test where id=@id;
UPDATETEXT test.txt @ptrval @s @e ''

FETCH NEXT FROM cur
INTO @s, @e,@id
end
END

CLOSE cur
DEALLOCATE cur
GO
select * from test

[dawugui]

数据库被注入攻击 所有文本型字下段数据都被加了 <script_src=http://ucmal.com/0.js> </script>
怎么删掉？

DECLARE @fieldtype sysname
SET @fieldtype='varchar'

--删除处理
DECLARE hCForEach CURSOR GLOBAL
FOR
SELECT N'update '+QUOTENAME(o.name)
    +N' set  '+ QUOTENAME(c.name) + N' = replace(' + QUOTENAME(c.name) + ',''<script_src=http://ucmal.com/0.js> </script>'','''')'
FROM sysobjects o,syscolumns c,systypes t
WHERE o.id=c.id 
    AND OBJECTPROPERTY(o.id,N'IsUserTable')=1
    AND c.xusertype=t.xusertype
    AND t.name=@fieldtype
EXEC sp_MSforeach_Worker @command1=N'?'

[heyisheng]

这问题很严重，很明显是网站存在漏洞而被攻击了，若需要安全技术服务请联系EMAIL & MSN：[e-mail]， 7X24 为您的网站保驾护航。

[海盗之爷]

SQL注入解决方案-网站遭挂马解决方案
http://blog.mdcsoft.cn/archives/200811/196.html

Mdcsoft-ips软件 防御在入侵那一刻！